Vulnerability

CVE-2026-113960

0.2%Chance of exploitation in the next 30 days (FIRST EPSS)

Not in KEVNo confirmed exploitation in CISA's catalog yet

What is it?

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined.

Official description from NVD.

What happened

Apple released updates fixing nine vulnerabilities across iOS 26, 27, iPadOS, macOS, watchOS, and visionOS. CVE-2026-113960 and CVE-2026-113961 enable message access in iMessage group chats. CVE-2026-113963 allows app access to sensitive user data. CVE-2026-113964 bypasses Bluetooth pairing code rate limits. Apply updates to patch privacy and authentication flaws.

From the Intel60 brief of Nov 10, 2026. AI-written summary: check the sources before acting.

Intel60 briefs

HighApple patches nine vulnerabilities across iOS, macOS, watchOSNov 10, 2026

Official records

NVDScores, affected versions and references
CVE.orgThe official CVE record